# 多阶段构建 - 构建阶段
FROM python:3.9-slim-bullseye as builder

# 设置镜像源环境变量
ENV DEBIAN_MIRROR=mirrors.aliyun.com

# 完全替换apt源配置并禁用官方源
RUN rm -f /etc/apt/sources.list.d/* && rm -f /etc/apt/sources.list && \
    echo 'APT::Get::AllowUnauthenticated "true";' > /etc/apt/apt.conf.d/99allow-unauthenticated && \
    echo 'APT::Get::Assume-Yes "true";' >> /etc/apt/apt.conf.d/99allow-unauthenticated && \
    echo 'APT::Install-Recommends "false";' >> /etc/apt/apt.conf.d/99allow-unauthenticated && \
    echo 'Acquire::Retries "1";' >> /etc/apt/apt.conf.d/99allow-unauthenticated && \
    echo 'Acquire::http::Timeout "10";' >> /etc/apt/apt.conf.d/99allow-unauthenticated

# 设置构建时环境变量
ENV PYTHONDONTWRITEBYTECODE=1
ENV PYTHONUNBUFFERED=1

# 安装构建依赖并使用阿里云镜像源
RUN echo "deb http://$DEBIAN_MIRROR/debian/ bullseye main contrib non-free" > /etc/apt/sources.list \
    && echo "deb http://$DEBIAN_MIRROR/debian/ bullseye-updates main contrib non-free" >> /etc/apt/sources.list \
    && echo "deb http://$DEBIAN_MIRROR/debian-security bullseye-security main contrib non-free" >> /etc/apt/sources.list \
    && apt-get update \
    && apt-get install -y --no-install-recommends \
       gcc \
       g++ \
       curl \
    && apt-get clean \
    && rm -rf /var/lib/apt/lists/*

# 创建虚拟环境
RUN python -m venv /opt/venv
ENV PATH="/opt/venv/bin:$PATH"

# 复制requirements文件并安装Python依赖
COPY production-requirements.txt .
RUN pip install --no-cache-dir --upgrade pip -i https://mirrors.aliyun.com/pypi/simple/ \
    && pip install --no-cache-dir -r production-requirements.txt -i https://mirrors.aliyun.com/pypi/simple/ --prefer-binary \
    && pip config set global.index-url https://mirrors.aliyun.com/pypi/simple/ \
    && pip config set global.timeout 120

# 多阶段构建 - 运行阶段
FROM python:3.9-slim-bullseye as runtime

# 设置镜像源环境变量
ENV DEBIAN_MIRROR=mirrors.aliyun.com

# 完全替换apt源配置并禁用官方源
RUN rm -f /etc/apt/sources.list.d/* && rm -f /etc/apt/sources.list && \
    echo 'APT::Get::AllowUnauthenticated "true";' > /etc/apt/apt.conf.d/99allow-unauthenticated && \
    echo 'APT::Get::Assume-Yes "true";' >> /etc/apt/apt.conf.d/99allow-unauthenticated && \
    echo 'APT::Install-Recommends "false";' >> /etc/apt/apt.conf.d/99allow-unauthenticated && \
    echo 'Acquire::Retries "1";' >> /etc/apt/apt.conf.d/99allow-unauthenticated && \
    echo 'Acquire::http::Timeout "10";' >> /etc/apt/apt.conf.d/99allow-unauthenticated

# 设置运行时环境变量
ENV PYTHONDONTWRITEBYTECODE=1
ENV PYTHONUNBUFFERED=1
ENV FLASK_ENV=production
ENV PATH="/opt/venv/bin:$PATH"

# 安装运行时必需的系统依赖并使用阿里云镜像源
RUN echo "deb http://$DEBIAN_MIRROR/debian/ bullseye main contrib non-free" > /etc/apt/sources.list \
    && echo "deb http://$DEBIAN_MIRROR/debian/ bullseye-updates main contrib non-free" >> /etc/apt/sources.list \
    && echo "deb http://$DEBIAN_MIRROR/debian-security bullseye-security main contrib non-free" >> /etc/apt/sources.list \
    && apt-get update \
    && apt-get install -y --no-install-recommends \
       curl \
    && apt-get clean \
    && rm -rf /var/lib/apt/lists/*

# 从构建阶段复制虚拟环境
COPY --from=builder /opt/venv /opt/venv

# 创建非root用户和必要目录
RUN groupadd -r appgroup && useradd -r -g appgroup -d /app -s /bin/bash appuser \
    && mkdir -p /app/logs /app/data \
    && chown -R appuser:appgroup /app \
    && chmod -R 755 /app/logs

# 设置工作目录
WORKDIR /app

# 复制应用代码（使用.dockerignore优化）
COPY --chown=appuser:appgroup . .

# 确保logs目录权限正确
USER root
RUN chown -R appuser:appgroup /app/logs && chmod -R 755 /app/logs

# 切换到非root用户
USER appuser

# 暴露端口
EXPOSE 5000

# 健康检查
HEALTHCHECK --interval=30s --timeout=10s --start-period=40s --retries=3 \
    CMD curl -f http://localhost:5000/ || exit 1

# 启动命令
CMD ["gunicorn", "--config", "gunicorn.conf.py", "app:app"]